That vulnerability seems like something added to adhere to the rule of 3. In at least Western culture, we have this ingrained thing for groups of 3 - for example Trinity, 3 point outline, 3 sentences in a paragraph etc.

It seems like this was picked to end up with 3 vulnerabilities so the security researchers can feel they did a complete job.